News for hackers. Stuff that matters.

hectorm

Show HN: Cardea, SSH bastion with per-key ACLs, TPM keys and session recording

https://github.com/hectorm/cardea

Author here. Cardea is an SSH bastion I wrote to manage access to some servers I administer. Access policies are defined in a single text file, similar to OpenSSH's authorized_keys format, with macros, server groups, time windows, and key expiry, so everything is reviewable in PRs and deployable with config management. No database, no web UI.Clients connect with any standard SSH client encoding...

( Read More... | no comments | on HN )

Show HN: Cardea, SSH bastion with per-key ACLs, TPM keys and session recording

https://github.com/hectorm/cardea

Author here. Cardea is an SSH bastion I wrote to manage access to some servers I administer. Access policies are defined in a single text file, similar to OpenSSH's authorized_keys format, with macros, server groups, time windows, and key expiry, so everything is reviewable in PRs and deployable with config management. No database, no web UI.Clients connect with any standard SSH client encoding...

( Read More... | no comments | 3 points | on HN )
Re:Chafa: Terminal Graphics for the 21st Century on Monday December 15, 2025 @06:08PM (#46282188)
Author of the JS bindings here. I also have a browser demo: https://ansi-o-matic.molinero.dev
Re:Tell HN: GitHub is partially blocked in India on Tuesday January 03, 2023 @12:39PM (#34234794)
* * *
Re:Tell HN: GitHub is partially blocked in India on Tuesday January 03, 2023 @12:00PM (#34234133)
Can anyone from India confirm if this proxy server [1] is enough to bypass the block?

Basically it is a proxy that alters HTTPS traffic to prevent DPI systems from detecting the domain during the TLS handshake. At least in Spain it works for me to bypass the blocking of the major ISPs [2].

[1] https://github.com/hectorm/demergi

[2] https://github.com/hectorm/demergi/blob/master/ISP.md

Re:Haiku R1/beta4 has been released on Friday December 23, 2022 @02:46PM (#34109856)
If anyone wants to quickly spin up a Haiku VM I leave here my Docker image [1].

It's just a proof of concept but some people are using it for CI as well [2].

[1] https://github.com/hectorm/docker-qemu-haiku

[2] https://github.com/HaikuArchives/ArtPaint/blob/7f5c49278545e...

Re:Docker Hub Registry is down on Monday December 20, 2021 @05:54PM (#29631571)
The specific URL of the incident is the following, but I cannot edit the submission.

https://status.docker.com/pages/incident/533c6539221ae15e3f0...

Re:Show HN: Windows 2000 on Docker on Sunday November 14, 2021 @03:48PM (#29220508)
You can of course set this up manually outside Docker, I provide this image so that you can easily have a preconfigured installation with VNC, RDP, bind shell and a Samba server.
Re:Show HN: Windows 2000 on Docker on Sunday November 14, 2021 @03:38PM (#29220436)
During the installation I add Netcat to have a bind shell, this way you can get a CMD shell from Linux using the "vmshell" command included in the image.

So yes, technically it's backdoored but only for yourself :)

Re:Show HN: Windows 2000 on Docker on Sunday November 14, 2021 @01:03PM (#29219049)
The ISO is downloaded from WinWorld, which is a website dedicated to archiving old software, it's certainly community maintained but at least gets some scrutiny. I also searched the checksum and it matches with other sources, but as there is no longer an official Microsoft source you can never be entirely sure.

I've done my best to confirm the legitimacy but if anyone has an original CD it would be awesome if they could confirm it.

Re:Show HN: Windows 2000 on Docker on Sunday November 14, 2021 @11:01AM (#29217958)
Effectively this is done as a POC, don't expect any security on a machine running Windows 2000 nowadays.

Regarding legality, I hope that Microsoft doesn't claim any rights, since the Windows 2000 image has been published in WinWorld for years without issues.

Re:Show HN: Windows 2000 on Docker on Sunday November 14, 2021 @10:47AM (#29217882)
I have a similar image with ReactOS if you want to compare :)

https://github.com/hectorm/docker-qemu-reactos

Re:WireGuard Gives Linux a Faster, More Secure VPN on Monday March 02, 2020 @01:31PM (#22467240)
In the case that someone has any trouble configuring WireGuard, I would like to share my automatic deployment of WireGuard and Unbound with full IPv4 and IPv6 support with Packer and Terraform in Hetzner Cloud (although it can be easily adapted to other providers) [1].

In the case that no automatic deployment is necessary, it may also be useful to look directly at the WireGuard configuration [2]. Since WireGuard supports scripts in "PostUp" and "PostDown", I have automated the configuration of iptables, including some useful rules to redirect 53/UDP port traffic from the public interface to WireGuard, which helps in some cases to bypass some firewalls.

[1]: https://github.com/hectorm/wireguard-setup

[2]: https://github.com/hectorm/wireguard-setup/blob/master/packe...

My current setup is a Docker container[0] with a musikcube[1] daemon in an ARM board (ROCK960 Model C) and on my phone I use the musikdroid client. At first, it was an investment of time, but now requires almost no maintenance.

[0]: https://github.com/hectorm/docker-musikcube

[1]: https://github.com/clangen/musikcube

Re:Way to store your dotfiles: A bare Git repository (2016) on Saturday April 06, 2019 @08:32PM (#19593966)
I use exactly the same approach but for convenience I use the following script as wrapper for git: https://gist.github.com/hectorm/8891f7f1916a4379f84dfaccc6fa...
Re:ReactOS 0.4.11 Released on Monday March 04, 2019 @04:51PM (#19305947)
If someone wants to try this version quickly, I made a Docker image with QEMU and noVNC [1][2]. I don't use it for anything important, just fun.

[1]: https://github.com/hectorm/docker-qemu-reactos

[2]: https://hub.docker.com/r/hectormolinero/qemu-reactos

Re:Make vs. Tup (2016) on Monday November 19, 2018 @01:44PM (#18488639)
I totally agree with you. Despite not having much experience with the tool, I recently used Make and M4 in a project to build Docker images for multiple architectures [1] and it worked really well.

[1] https://github.com/hectorm/hblock-resolver/blob/master/Makef...

Re:Mmm, Pi-hole on Wednesday September 26, 2018 @01:39PM (#18078366)
I'm currently using my own solution [1] based on Knot Resolver, a shell script [2] that creates a blacklist from multiple sources and DNS over TLS to 1.1.1.1. It doesn't have a web interface as complete as Pi-hole, but it's very lightweight.

To block ads when I'm not at home, I use WireGuard and pass DNS traffic through it.

[1] https://github.com/hectorm/hblock-resolver

[2] https://github.com/hectorm/hblock